If you didn't want the CIA (or a hacker with a personal agenda against you - sometimes it's hard to know which is worse) to know what you are saying to a friend, you can use codes to obfuscate the message. This is called cryptography - "kryptos" is Greek for "hidden", "graphein" for "writing": the art of hiding your writing.

There have been many ciphers throughout History. Some are just ways of being able to hide a message in plain sight. These are usually substituion ciphers like the pigpen cipher and steganography. If you know these techniques, you won't have trouble decoding the message within. Some others are ways of making a message harder to read by looking like gibberish. That's when we get into real cryptography.

Nowadays we have supercomputers in our pockets. Any of the 26! (that's 26 factorial: 26*25*24*...*2*1) combinations of letters in a message with a substitution cipher can be produced in less than a second, and the real message can be deduced with the help of bayesian probability (the letter "E" is the most common in English texts, so it's not unlikely that it will be the most frequent in a message).

We need more complex algorithms, but we can't just treat them haphazadly. For example, hashing (which is how your passwords are hopefully stored in a database) are very useful to avoid collision between hashes (as in, no two words have the same hash unless they're the same) and are pretty good at making it unguessable what the original word was, but that also means you can't reverse the process to decrypt the word. The Vigenere Cipher is useful at making words unguessable by anyone without the passcode (well, it can be broken now but that's beside the point I'm making), but if the passcode is intercepted the cat is out of the bag.

That is to say that we need to know what we want out of an encryption method before we commit to it.

PGP is useful because it solves four problems:

1. Only the person that's intended to see the message can read it
2. Only the person that's supposed to have written it can sign it
3. Even if every message (including the credentials) is intercepted, these two properties will still have to hold up
4. Fast

From these properties, we can derive the tools used.

1. There must be a decryption key only the reader has
2. There must be an encryption key only the writer has
3. The decryption keys must ALWAYS be secret
4. This process must be symmetric

The first three properties can be fulfilled with asymmetric encryption. This is when both people have two keys: one public and one private. They send the public key to one another. Messages encrypted with the public key can only be encrypted with the private key and vice-versa, but a public key can never decrypt a message encrypted with that public key. The same goes for the private key.

For example, you want to send me a message. You have my public key, so you encrypt the message with that, and then send me the message. Now it can only be encrypted with my private key, which only I have. Objectives 1 and 3 are guaranteed in this method.

For objective 2, you can sign your message before encryption: encrypt the message with your private key, encrypt the encrypted message with my public key and send me your public key. I can then unencrypt the message with my private key, then unencrypt it again with your public key. This gives us a secure method of communication that people with only my public key and your public key would be unable to read. You may also find that this "signature" method is the only part of PGP that my website actually uses - I don't know the public key of any of my readers, and I do want to keep the message readable for anyone coming in.

However, there is one more problem. If you know about cryptography you will know that this last statement contradicts everything else that's said before. The fourth objective is for it to be fast, but asymmetric encryption has a tendency to be very slow.

Symmetric encryption - when there is a decryption key that is known by both parties - actively goes against point 1 (only the reader has the decryption key), point 2 (only the writer has the encryption key) and point 3 (if they agree on a key and someone else is listening, the attacker knows the decryption keys). With that said, symmetric encryption like AES is very fast and can be incredibly robust if you get over the drawbacks.

The solution you will find is very simple: use a mix of both. Use asymmetric encryption to send the key for symmetric encryption. Also, if every message has a different symmetric encryption, even if one message is broken they still can't get to the next one.

So what actually ends up happening is this:

1. Choose random number, this will be our AES key
2. Sign the AES key with your private key
3. Compress the message so that there is less to encrypt
4. Encrypt the message using AES with the key chosen in step 1
5. Send the encrypted message and the encrypted key